Latest Windows update removed ChilkatCrypt2.dll, breaking 1password - Critical Component Missing

Options

Hello,

I woke up this morning, and my PC was asking me to reboot to install critical updates. I accepted and rebooted, and upon reboot 1password would not start with an error saying a critical component was missing. Re-installing the application would also fail, saying the ChilkatCrypt2.dll file could not be found. When I went and looked for it in Windows/System32, it was not there.

I used System Restore to revert the update, and 1password works again with no error. I've checked, and the ChilkatCrypt2.dll is still not in Windows/System32 (??) but 1password is working correctly.

I am nervous about proceeding with Windows update at this time. Although it's possible this is a problem with just my machine, I wanted to post here in case others are having similar problems.

Nathan

Comments

  • mikeybyker
    mikeybyker
    Community Member
    Options

    Hi - exactly the same here! Turned my computer on and as soon as it booted, 1Password prompt told me ChilkatCrypt2.dll was missing and to reinstall as admin (I hadn't even launched 1password or a browser). I tried this - and each time I get the same "ChilkatCrypt2.dll file could not be found" error and the installation aborts.
    I've looked for the file, and in system backups (3rd party, not windows system restore) - it isn't in the specified path (C:\Windows\System32).

    Strangely enough, searching a full-drive backup, there is the ChilkatCrypt2.dll file - but in C:\Windows\SysWOW64\ instead of the path 1password is looking in...

    I don't have system restore points so can't roll back - and I can't install 1password due to this error...

    Any help much appreciated!

    Mike

  • trackley
    trackley
    Community Member
    edited May 2013
    Options

    Yes. Something like this just occurred also, but for me Avast started saying that it found the trojan in
    ChilkatCrypt2.dll and suggested I do a boot up scan.

    The boot up scan has identified the same Trojan (MSIL:Crypt-NB[Trj] in
    ChilkatCrypt2.dll
    ChilkatZip2.dll

    and every 1password update that i have downloaded from
    1password-1.0.9.299.exe
    to
    1password-1.0.9.327.exe
    that were still present in my users..\appdata\local\temp folder.

    I deleted all these "infections" even if it is a false alarm.

    It's still scanning the rest of the drive. I assume that when i am back up and running, my 1password will be broke as well and require a full reinstall.

    troy

  • JHW
    JHW
    Community Member
    edited May 2013
    Options

    The same Trojan infection was reported today by Avast on my two Windows machines with 1Password installed. It must have something to do with Avast's signature update 130507-0 which was installed shortly before the detection. I didn't receive any Windows updates today by the way...

  • GrumpyM
    GrumpyM
    Community Member
    Options

    I am the OP above, and wanted to add that I am also running Avast. I didn't get any errors from Avast though, but it might be because it was on Silent/Gaming mode (whatever that means).

  • JHW
    JHW
    Community Member
    Options

    I uploaded my local Chilkatzip2.DLL as well as the 1password-1.0.9.327.exe from my temp folder at virustotal and received detections only from Avast and Gdata, which also uses the Avast engine. The other scanners didn't detect any malware. So it's almost certainly a false positive, but an official statement from the Agile Bits support would be highly appreciated.

  • JHW
    JHW
    Community Member
    Options

    This Avast false positive appears to affect other programs besides 1Password as well: forum.avast.com/index.php?topic=123386.0

  • MikeT
    Options

    Hi guys,

    We've notified Avast about this false positive, and they just confirmed it for us, they're working on fixing it as fast as they can. I don't know when they'll push the definition update to Avast to remove the file as infected but for now, you'll need to whitelist the file to let 1Password run. It is absolutely clean and not modified nor infected, it appears to be a mistake in the heuristics, which is why @JHW mentioned about other apps.

    Any files that appears to be close to the same Chilkatzip2.dll, it'll be flagged as infected, even if it is not.

  • tdube
    tdube
    Community Member
    Options

    THANKS for update...

  • tdube
    tdube
    Community Member
    Options

    BTW - just got an avast update to the main program - asked for restart. - hopefully this gets fixed!

  • tdube
    tdube
    Community Member
    Options

    Restarted - still didnt work but then forced a definitions update ad got a rev-1 update.. Worked.

  • MikeT
    Options

    Hi @tdube,

    That's great, thanks for letting us know!

  • JHW
    JHW
    Community Member
    Options

    Same here, the problem has been fixed by the newest Avast software and definition updates. Thanks for the feedback!

    (Things like these make me wish I had already completed my personal IT infrastructure's migration away from Windows though...)

  • khad
    khad
    1Password Alumni
    Options

    Great news! Thanks for confirming.

    If we can be of further assistance, please let us know. We are always here to help!

This discussion has been closed.